I've setup a vti to use ospf over an ipsec tunnel between two routers.
If I ping the other router it goes straight to it but if I ping a device on the other network it goes via the VTI adding a hop.
clive@Slinfold-192-168-14-254:~$ traceroute 192.168.13.254
traceroute to 192.168.13.254 (192.168.13.254), 30 hops max, 38 byte packets
1 192.168.13.254 (192.168.13.254) 0.800 ms 0.463 ms 0.413 ms
clive@Slinfold-192-168-14-254:~$ traceroute 192.168.13.21
traceroute to 192.168.13.21 (192.168.13.21), 30 hops max, 38 byte packets
1 10.0.0.2 (10.0.0.2) 0.833 ms 0.468 ms 0.401 ms
2 192.168.13.21 (192.168.13.21) 0.730 ms 0.802 ms 0.740 ms
Do I need a VTI to get basic routing between the two networks?
vti vti0 {
address 10.0.0.1/30
ip {
ospf {
dead-interval 40
hello-interval 10
network point-to-point
priority 1
retransmit-interval 5
transmit-delay 1
}
}
mtu 1436
}
ipsec {
auto-firewall-nat-exclude enable
esp-group ESP {
compression disable
lifetime 3600
mode tunnel
pfs enable
proposal 1 {
encryption aes128
hash sha1
}
}
ike-group IKE {
dead-peer-detection {
action restart
interval 15
timeout 60
}
ikev2-reauth yes
key-exchange ikev1
lifetime 28800
proposal 1 {
dh-group 14
encryption aes128
hash sha1
}
}
ipsec-interfaces {
interface eth0
}
site-to-site {
peer 192.168.1.12 {
authentication {
mode pre-shared-secret
pre-shared-secret ********
}
connection-type initiate
description Pulborough
ike-group IKE
ikev2-reauth inherit
local-address 192.168.1.11
vti {
bind vti0
esp-group ESP
}
}
}
}